Most coding audits in small practices happen for one of two reasons: a payer sent a records request, or a new practice manager wants to know what she inherited. Neither is a bad reason. But an audit run once, under pressure, with no method, produces a number ("we are 88 percent accurate") that nobody can act on, and the same errors are still there the following year.
The fourth quarter is a sensible time to audit because the year's documentation is mostly complete, the results can shape January training, and any overpayment identified can be handled while the claims are still well within payer lookback periods. The federal Office of Inspector General's General Compliance Program Guidance, updated in November 2023, describes auditing and monitoring as a core element of a compliance program, and a practice that can show an annual audit with documented follow-up is in a very different position from one that cannot.
Here is the method we use. It fits in about three working days for a practice of five to eight providers, plus the time the providers spend reviewing their own results.
Key takeaways
- Let the billing data choose the focused sample: a provider whose level distribution or modifier 25 rate is far from the group's is where to look.
- Ten paid encounters per provider for the random sample, ten to fifteen for a focused area, spread across the year and payers, with at least two Medicare encounters each.
- Office visits are audited on medical decision making or total time, not history and exam bullets. Two of three MDM elements must support the level.
- Report per provider with note excerpts, count under-coding as an error too, and end with a dated training plan and a re-audit date.
- If the findings point to an overpayment, do not extrapolate a refund from ten charts and do not ignore it. Involve counsel on scope and repayment.
Decide what kind of audit this is
A prospective audit reviews encounters before the claims go out; a retrospective audit reviews paid claims. Year-end audits are retrospective. Decide also whether the sample is random or focused. We do both: a random sample per provider to estimate overall accuracy, and a focused sample on the two or three areas where the practice's billing data looks unusual. The billing data tells you where to look. A provider whose office visits are 70 percent 99214 when the group averages 45 percent is a focused sample. So is anyone billing modifier 25 on more than a third of visits with a procedure, or anyone who never bills 99213.
Run the level distribution report before anything else: for each provider, the share of established visits billed at 99212, 99213, 99214 and 99215 for the year, next to the group's share and, if you have it, the specialty's Medicare distribution. It takes ten minutes and it is the single most useful page in the audit file, because it turns "we should look at Dr. A" into a number Dr. A can see.
Sample size
For the random sample, ten paid encounters per provider is a common working number and is the size many compliance advisors suggest for a baseline review. It is enough to find patterns; it is not enough to extrapolate a dollar figure with any confidence, and we think practices should resist doing so. For the focused sample, pull ten to fifteen encounters in the specific area of concern. Spread the sample across the year and across payers, and include at least two Medicare encounters per provider because that is where the highest-consequence rules apply.
What to check on office visits
Since January 1, 2021, office and outpatient E/M levels (99202 to 99215) are selected by medical decision making or by total time on the date of the encounter, not by history and exam elements. Auditors who still count bullets produce wrong findings. For each visit, the checklist is:
- Which method was used, and is it clear? If time, is the total time documented as a number, and does it include only the provider's activities on the date of service? If MDM, can you identify the problems addressed, the data reviewed or ordered, and the risk of management?
- Do the three MDM elements support the level? Two of three elements must meet or exceed the level billed. The common failure is a 99214 supported by one moderate element and two low ones.
- Is the problem "addressed" or merely listed? A chronic condition mentioned in the problem list but not evaluated or managed in the note does not count toward MDM.
- Modifier 25. When a procedure was performed on the same day, is the E/M significant and separately identifiable, with its own documentation beyond the decision to perform the procedure?
- Add-on codes. Is the visit complexity add-on (G2211 for Medicare) supported by a longitudinal relationship as described in Medicare's guidance? Are prolonged service codes supported by documented time above the threshold?
- Diagnosis coding. Do the ICD-10-CM codes reflect the documented conditions at the correct specificity, and is the first-listed diagnosis the reason for the visit?
- Signature and date. Is the note signed by the rendering provider, and does the date of service on the claim match the note?
Scoring and reporting
| Finding type | How we score it | Example |
|---|---|---|
| Level supported | Correct | 99214 billed; two moderate MDM elements documented |
| Over-coded | Error, with the supported level noted | 99214 billed; documentation supports 99213 |
| Under-coded | Error, with the supported level noted | 99213 billed; documentation supports 99214 |
| Unsupported modifier or add-on | Error | Modifier 25 with no separately identifiable E/M |
| Documentation deficiency without a level change | Note, not error | Time stated as a range instead of a total |
Report per provider: the number reviewed, the number correct, the errors by type, and two or three specific note excerpts that illustrate the most frequent error. Under-coding is an error too, and in primary care we find it about as often as over-coding. Then report at the practice level: which error types recur across providers (those are training problems) and which belong to one provider (those are coaching problems). The report should end with a training plan with dates, and a re-audit date for the providers with the most findings.
A worked example
A six-provider internal medicine group ran the level distribution report and found two outliers: one physician at 78 percent 99214 against a group average of 52 percent, and a nurse practitioner at 61 percent 99213 with almost no 99214s. The random sample of ten per provider came back with 47 of 60 encounters correct. The physician's ten showed four over-coded visits, each a 99214 where the note addressed one stable chronic condition with a prescription refill and nothing else; the MDM supported 99213. The nurse practitioner's ten showed three under-coded visits, each a 99213 where two chronic conditions were addressed with medication changes, which supports 99214. Across the group, five encounters had modifier 25 on a visit whose only documented content was the decision to do the procedure.
The report went to each provider with their own notes attached. The physician's training was one session on counting problems addressed and risk; the nurse practitioner's was one session on recognizing when two chronic conditions with management changes reach moderate MDM. The modifier 25 finding became a group rule: the E/M note must stand on its own without the procedure paragraph. The physician's over-coded encounters went to counsel with the question of scope; the group did not attempt to calculate a refund from four charts. Both outliers were re-audited with five charts each in March.
When the findings point to an overpayment
If the audit identifies claims that were paid at a level the documentation does not support, the practice has an obligation to deal with it. Medicare's rules require identified overpayments to be reported and returned within 60 days of identification, and commercial contracts have their own provisions. Do not extrapolate from a ten-chart sample to a refund figure on your own, and do not ignore the finding either. This is the point at which the practice should involve health care counsel or a compliance advisor to decide the scope of any further review and the method of repayment. We are describing the operational steps here, not giving legal advice; the decision about how to quantify and return an overpayment is one for counsel.
Questions we hear
Should the practice's own coder do the audit?
The coder who coded the encounters should not be the one auditing them. A second coder in the group, a coder from another practice under a reciprocal arrangement, or an outside reviewer all work. What matters is independence and a written method. Revelrex's RCM audit includes a coding review built on the checklist above, and our training courses teach the same method to in-house teams.
How do providers react?
Better than most managers expect, when the report shows their own notes and the exact reason a level was or was not supported. Worse when it shows a percentage with no examples. Sit down with each provider individually, walk through two encounters, and agree on one change.
How often after this?
Annually for the random sample, and a five-chart spot check within 90 days for any provider with more than two errors in ten. New providers get a ten-chart review at 60 days regardless of the results elsewhere.
What to do this month
- Run the E/M level distribution and modifier 25 rate by provider for the year to date, and mark the outliers.
- Decide who audits: a second coder, a reciprocal arrangement or an outside reviewer, and write the checklist down before they start.
- Pull ten random paid encounters per provider, spread across the year and payers with at least two Medicare visits each, plus ten to fifteen in each focused area.
- Score with the table above, and write the per-provider report with note excerpts.
- Schedule the individual provider conversations and the January training, and put the re-audit dates on the calendar.
- If any finding looks like an overpayment, record the date and call counsel before deciding what else to review.
